similar to: ksoftirqd_CPU0 extreme CPU usage

Hi all, First of all I repost this email in shorewall list as there are a lot of firewall experts here that might know what the hell i going on. We have also posted this on the linux bridge list (we needed acceptance first) and leaf list. Very thankful for your understanding. We are experiencing a very strange problem and would need some help. We have a Leaf / Shorewall based box (actually

Hi all, I have found problems in p2p traffic detection. The ipp2p module works fine but in shorewall the rules written for this protocols never match because the initials p2p connection (login) match in ''-m state --state RELATED,ESTABLISHED -j ACCEPT'' rule before ''-m ipp2p --ipp2p -j DROP'' rule, so netfilter never filter p2p traffic. I have had to run

Hi all, http://www.hipac.org/index.htm I have just discovered this great project. It seems it surpasses standard netfilter in performance. The documentation states they are more or less compatible with standard netfilter, but anybody has tested if it is compatible with shorewall? Tom, have you? Regards -- Jaime Nebrera - jnebrera@eneotecnologia.com Consultor TI - ENEO Tecnologia SL

Hi all, We want to do some stress testing of firewall configurations/hardware. We have discovered hping that seems a great tool for this, but funny enough Shorewall cuts it !!! even when you leave ports open :) So besides hping, any tool for this? Why is shorewall cutting this traffic? Thanks in advance. Regards. -- Jaime Nebrera - jnebrera@eneotecnologia.com Consultor TI - ENEO

Hi all, Anybody has configured a Shorewall firewall to protect Citrix servers? Could you give us some clue on the rules you have to define? Citrix opens a connection from the inside to the outside from a different port (more or less like ftp) and seems not works. Regards -- Jaime Nebrera - jnebrera@eneotecnologia.com Consultor TI - ENEO Tecnologia SL Telf.- 95 455 40 62 - 619 04 55 18

Hi all, I have seen Shorewall places the state verification rules (-m state --state ESTABLISHED,RELATED) as the first rule in a zone2zone chain. This means that state checking is done after all the rules involving from this zone to this zone. As you could have a lot of them, wont be better to place them just after checking the state is not invalid? This will mean a lot of packages will be

Hi Tom and folks, There are some svn or cvs system for the shorewall-dev community?. If Tom want to leave the project for a while, maybe it will be necesary some cooperation system. Regards. -- Juan Jes?s Prieto - Consultor?a TI jjprieto@eneotecnologia.com http://www.eneotecnologia.com --------------------------------------- fingerprint: BFC2 0370 7708 F800 0BEC 60A4 EC71 4BB1 CC85 99F5

Is anyone using an inline IDS like hogwash or snort-inline to drop packets in a system running shoreline? I _think_ I see how to configure it, but I''d be really interested in finding a howto or something... Thanks! Mike- -- Mornings: Evolution in action. Only the grumpy will survive. -- Please note - Due to the intense volume of spam, we have installed site-wide spam filters at

I believe that 2.4.0 is about ready to be sent out the door. I''ve made a couple of small changes since RC2 but I don''t believe that they warrant another RC. There remains the issue of what to do about support for Shorewall 2.0 given that 2.2 has only been available since March. It would be my recommendation to make 2.4 the new "stable" release but continue to

Hi all, We are investigating on firewall failover design. I have searched the net and found that projects like LVS have it mostly solved for their side but that netfilter lacks it. Of course, a simple failover of the firewall is available using things like VRRP (KeepAlive software) but without state syncronization, and that is preciselly the part we need to investigate. Is this issue

I made an atempt to run snort_inline and shorewall on the same system but I could not get snort to see the packets. Maybe someone with a little more iptables knowledge could tell me what I''m doing wrong or if its possible to have the systems setup so that it places packets that the firewall would allow into QUEUE. After setting up and starting shorewall I then issue the following

Hello I am looking for a way to have snort to dynamically update my shorewall config. I have seen software out there but I would like to see if anyone had tried this first. Aslo I would like to know if there is a way clear the Netfilter tables when I do a shorewall restart. The reason being is that when I make a change to my firewall setting I want all connections to have to re-establish

Hi I''m currently setting up a game server and have opened all ports needed to run it. What other options do I have regarding protecting the open ports? I''m worried about people attacking the open ports to render the server useless. Any help or advice would be appreciated. Thank you. Recoil UK

Hi list, I''m using Dom0 gentoo with xen 3.0.4 and xenman. I have several DomU working and it is really nice :) so all my DomUs are installed with disk images. Now i want to use an ISO to boot and install a linux system (or win). When i try to boot the DomU i dont have nothing, nothing relevant (for me) in logs and i can connect to the console. The state of the DomU is unknow. Any help

Hi all, I''m working on a patch for shorewall to make it run with a Crossbeam X40 machine (www.crossbeamsystems.com) and I would like to know where to send it, is this list the correct location?. The patch is necesary because of Crossbeam X series running mode: when you make a shorewall start, restart or clear, there are a packet dropping until shorewall is Started or cleaned. At

Hello, we are using HTB for dividing 15 Mb/s upload rate to 1022 classes (rate 14 kb/s, ceil 15 Mb/s), but sometimes ksoftirqd_CPU0 uses the most of the CPU-time (over 90% CPU load is casual in such situation). This situation occurs several times a week and takes minutes or one hour and during that time it has enormous packet loss. Reboot of the machine usually solves this problem. Because

Hello All, Wondering what sort of real world mileage people are getting out of different internet connecions - i.e. different DSL connection speeds, cable modems, etc... Is it reasonable to hope to carry 10 - 15 concurrent calls on a 768K DSL? I'm not talking about theoretical BW or looking for any difinitive absolute guarantee... With DSL and Cable - there is no guarantee, so I'm

(Sent to linux-raid, linux-kernel and ext3-users since I'm not sure what type of issue this is) I've got a test system here running Redhat 7.1 + stock 2.4.9 with these patches: http://www.fys.uio.no/~trondmy/src/2.4.9/linux-2.4.9-NFS_ALL.dif http://www.zip.com.au/~akpm/ext3-2.4-0.9.6-249.gz http://domsch.com/linux/aacraid/linux-2.4.9-aacraid-20010816.patch All three patches applied

Hi, This morning I had some failed calls. On the console (and in the log) I saw the error "Unable to allocate channel structure". Before I restarted the process, I checked it's memory usage in ps and glanced at my free memory in top. Asterisk was using a normal ammount of memory, about 40M. I don't think this was a system limit. This was running Asterisk v1.0.2. Below is

Hi, We are trying to validate Asterisk as a media gateway PRI <-> SIP with two T400P (8 T1s) per box. The first experience with BOX1 (Compaq, 2.53 GHz, 1 Gb RAM) and just one T400P was encouraging - on the load test with 3 T1s worth of calls we had on average 75% idle CPU. Not so with BOX2 (Dell, single 2.6 GHz Xeon, 1 Gb RAM, 2 T400P) and BOX3 (Dell, dual 2.6 GHz Xeon, 2 Gb RAM, 2 T400P,